The cyber security buying committee is bigger than the CISO

A security purchase in Australia is now a committee decision, and AI governance is adding seats to that committee.

TAL Australia’s Chief Information Security Officer (CISO), Maryam Bechtel, makes a point of getting to know many of those people early: the CIO, finance, crisis management, audit, legal and communications.

“You don’t want to meet these people when crisis happens”, she told the audience at ADAPT’s 13th Security Edge in Sydney.

Across the day’s sessions, security leaders described a cyber security buying committee that runs from the CFO’s office to the board, with a different test at each seat.

ADAPT research presented at Security Edge last September 2026 shows AI governance is the CISO’s #1 security priority and #1 constraint, yet only 2% of CIOs think the CISO should own it.

The money is there.

ADAPT’s pre-event survey shows AI security, governance and model protection is the #1 capability area security leaders plan to change or expand over the next 12 to 24 months, with around three quarters planning to upgrade their AI security platform in that time.

Working out who signs off that spend is the harder job for vendors.

In this article:

• Who sits on the buying committee
• Why AI governance widens the group
• The CFO vendors forget
• Why recovery is a CIO question
• Recommended actions for vendors

The committee starts well beyond the CISO

Maryam’s list is a useful starting map.

Alongside the CISO, a typical buying group includes the CIO, CFO, chief risk officer, legal, crisis and communications leads, the board and independent advisers, with data leaders joining any decision that touches AI.

Boards spending millions on cyber want to know what that money achieves in risk posture and appetite, according to Suncorp Group’s CISO, Keith Howard.

“It’s not just about the activities, activities, activities”, he says.

A vendor whose reporting stops at alerts handled or policies deployed leaves the CISO with little to put in front of directors.

David Gee, former CISO and ADAPT Advisor, learned to win over the risk function before anything went wrong.

At Macquarie, he held 60 to 90 minute briefings with a newly appointed chief risk officer and turned them into an advocate for security decisions at executive level.

Most vendors will never sit in front of these stakeholders.

Their proposal reaches the board and the risk function through the CISO, carried on credibility the CISO has spent years building, and an inflated claim spends that credibility on the vendor’s behalf

Back to top

Nobody owns AI governance, so more people sign off

ADAPT research presented at Security Edge Sydney shows only 7% of CISOs have defined controls and ownership in place for governing AI agents and non-human identities, and large enterprises score just as low.

ADAPT’s Head of Strategy, Joey Meynink, adds that over 90% of CIOs report no enterprise-wide AI governance with board involvement.

Without a clear owner, a purchase of agent or identity controls can need sign-off from security, technology, data and risk at the same time.

Gabby Fredkin, ADAPT’s Head of Analytics & Insights, points to research showing 50% of AI tools in pilot or deployment are not covered by a formal governance framework, which he calls a scaling problem.

Organisations that build governance into the architecture early get models into production faster, while those that add it later end up trading features against security and risk.

The questions buyers ask have also become more specific.

Across the roughly 25 AI governance roundtables ADAPT runs each year, Gabby has watched the focus move from ownership, bias and ethics to model visibility, shadow AI and what agents can access.

They now focus on model visibility, shadow AI and what agents can access.

ADAPT’s Senior Research Director, Matt Boon, wants security, technology and business teams blended so organisations can keep pace with AI.

Until that happens, a vendor selling agent or identity controls is likely to pitch the same product to several teams, each with its own view of the risk.

Some buyers have already built a path through that tangle.

At Coates, Head of Cyber Security and Risk Mohamed Omran names an owner whenever a risk spans several teams or external providers, and sets clear contractual expectations for suppliers.

New AI tools are tested in a sandbox, code and packages are scanned, and ownership is defined before anything moves towards production.

Security partners’ capabilities go through carefully tested private previews before wider deployment.

Mohamed calls the approach “yes, securely”.

Kunal Makwana, Security Operations Manager at Bank Australia, draws the line at accountability.

AI can recommend, automate and accelerate work, but the people and business acting on its output remain accountable, and trusted advisers can help business teams understand where the boundaries sit.

That leaves vendors a defined role.

They can help a buyer set those boundaries and prove the product inside them, while the decision itself stays with the business.

Back to top

The CFO is the stakeholder vendors forget

ADAPT research presented by Joey shows CFOs rank risk and compliance, ahead of revenue or cost, as the #1 factor when budgeting for AI.

Finance therefore sits at the centre of AI security spending, yet Maryam described it as the relationship CISOs most often forget, despite its role in frank conversations about how much risk buy-down the organisation will pay for.

Finance therefore sits at the centre of AI security spending, yet Maryam described it as the relationship CISOs most often forget, despite its role in frank conversations about how much risk buydown the organisation will pay for.

She splits security spend into three mandates: reduce risk, stay compliant and enable the business.

When money runs short, risk and compliance get funded first because they protect the licence to operate.

Enablement is the mandate that gets forgotten.

A product sold as enablement competes for the money most likely to be cut, while one tied to a risk or compliance outcome draws on the budget finance already protects.

AI is pulling finance in further.

“Cost stopped being a line item and started being a meter”, Gabby says, with token spend blowing out fastest inside technology teams.

The security leaders Matt speaks with are responding by applying FinOps principles to AI spend.

Once finance tracks AI costs that closely, every proposal has to show what each dollar changes.

A higher maturity score won’t pass that test on its own. Keith warns boards against chasing a framework number if the spend doesn’t improve real posture.

Back to top

Recovery is a CIO question

ADAPT research presented at Security Edge shows the pace of evolving threats jumped from the #8 barrier CISOs face to #3 in a single research wave, and cyber resilience is now their #2 concern after AI.

Greg Rattray, former Global CISO at JPMorgan Chase, doesn’t expect the CISO to carry that alone.

“Resilience is not the responsibility of CISOs in large measure”, he says.

In the tabletop exercises he runs, the decisive moment comes when the CEO turns to the CIO and asks how fast encrypted services can be recovered.

In his experience, many CIOs have return-to-operations targets they have never tested.

Communications belongs in that conversation too. Greg recalled JPMorgan’s leadership rating its communications team the best part of one incident response.

At Suncorp, the old three-year security planning cycle no longer holds.

Keith’s team now reprioritises monthly based on threat intelligence, so a business case built on last quarter’s threat picture can lose its place in the next.

Back to top

Recommended actions for vendors

Vendors selling into a security buying committee can strengthen their position with five changes to how they run a deal.

1. Map every stakeholder on the deal, from the CIO and CFO to crisis management, audit, legal and communications, and note what each needs to see before they back a purchase.
2. Tie the CFO case to one funding bucket. Link it to the risk, compliance or enablement outcome that will pay for it, and model the running cost as well as the licence.
3. Give the CISO language the board can use. Translate technical detail into changes in risk posture and appetite that can go straight into a board paper.
4. Brief risk leaders early, so the chief risk officer understands the exposure a product addresses before the deal reaches committee.
5. Bring evidence that survives independent review, and show how the product changes day-to-day operations.

Back to top

The buying group forms before the deal does

Security deals are now decided by a committee the vendor rarely meets in full.

Finance weighs the case through risk and compliance, the CIO through recovery and the board through change in posture, and each of those judgements reaches the room through the CISO.

AI governance is the question still open.

Until organisations settle who owns it, every security proposal carries an unasked question about who will own the risk it addresses, and vendors who help buyers answer it give the CISO a case the rest of the committee can approve.

Back to top

See what each seat on the committee is weighing before your next proposal.

Advantage, ADAPT’s Market & Buyer Intelligence Platform, tracks how A/NZ CISOs, CIOs and CFOs prioritise security and AI spend, across more than 80,000 local data points. Explore Advantage.